CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2021-38186
Medium (6.1) in comrak project comrak. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in comrak 0.10.1.
An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- comrak_project:comrak
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6wj2-g87r-pm62 | crates.io | comrak | <0.10.1 | 0.10.1 |
| RUSTSEC-2021-0063 | crates.io | comrak | >=0.0.0-0 <0.10.1 | 0.10.1 |